Sr. Software Engineer (SDE-1 DevOps & Security)

Security Engineer (SDE-1)

Pluang is Indonesia's leading multi-asset investment platform, offering products such as Crypto, US stocks, mutual funds, and gold. At Pluang, we're on a mission to redefine the way people invest. As one of the fastest-growing fintech platforms in Indonesia, we empower users to achieve financial independence through a seamless, innovative, and secure investment experience.Explore more about us here!

We're hiring a Security Engineer (SDE-1) to join our security team and help us secure the next generation of fintech products. This is a great role for someone early in their security career who wants hands-on exposure to detection engineering, incident response, and cloud security in a fast-moving fintech environment, working closely with senior engineers on the team.

What You Will Do

• Application Security (AppSec)

  • Work on static and dynamic application security testing (SAST/DAST) across codebases and applications under guidance.

  • Conduct API security testing and review REST/GraphQL endpoints for authorization and authentication flaws.

  • Support secure code reviews and help identify common software vulnerabilities (OWASP Top 10) in development pipelines.

  • Work with engineering teams to triage, track, and remediate application security vulnerabilities.

  • Assist in integrating security tooling and guardrails into CI/CD pipelines and developer workflows.

  • Support vulnerability management for third-party libraries, APIs, and open-source components (SCA).

• Security Operations Center (SOC)

  • Monitor security alerts and dashboards (SIEM/EDR/WAF) and triage based on defined playbooks and runbooks.

  • Support senior engineers in investigating and responding to security incidents, escalating per runbook when needed.

  • Participate in rotational on-call/shift coverage as part of the security operations team.

What We're Looking For

• 0–2 years of experience with, or strong academic/project exposure to: BurpSuite, OWASP ZAP, SIEM, EDR, and log management platforms (Elasticsearch, OpenSearch, Splunk, Wazuh, CrowdStrike, Sentinel, etc.).

• API & Web Security: Solid understanding of REST/GraphQL API security, common vulnerabilities, and authentication/authorization mechanisms (e.g., OAuth2, JWT).

• Depth in Mobile Application Security (MASVS standards, basic Android/iOS reverse engineering, dynamic analysis).

• Familiarity with secure coding principles and code review practices in common languages like Java, Python, Go, Rust etc.

• Solid fundamentals in networking and operating systems (TCP/IP, DNS, Linux/Windows internals) and how common attacks exploit them.

• Basic scripting ability (Python or Bash) to support automation and log analysis.

• Exposure to SIEM/log analysis concepts (e.g., Elasticsearch, OpenSearch, Splunk, Wazuh) through coursework, labs, internships, or personal projects.

• Strong willingness to learn, good analytical and problem-solving skills, and the ability to work collaboratively with compliance, risk, and engineering teams.

• A degree in Computer Science, Information Security, or a related field, or equivalent Offensive security or AppSec certifications/practical experience (e.g., BSCP, eJPT, CPTS, PNPT, or active Bug Bounty / CTF participation).

• Willingness to work in a rotational/on-call shift schedule as part of the security operations team.

Good to Have Experience / Skills

• Hands-on exposure to DevSecOps tools and pipeline security integration (e.g., Snyk, SonarQube, Semgrep, Trivy, Dependabot).

• Exposure to EDR tools (CrowdStrike, Sentinel) and WAF solutions (Cloudflare, Akamai, AWS WAF), and how detection policies are tuned.

• Exposure to cloud environments (AWS/GCP/Azure) and basic cloud logging concepts (e.g., CloudTrail, Security Command Center).

• Familiarity with MITRE ATT&CK and general threat hunting concepts.

• Exposure to SOAR platforms and security automation.

• Familiarity with container and Kubernetes monitoring/logging concepts.

• Prior internship or project experience in a SOC, blue team, or security operations setting.

• Interest or coursework/self-study in forensic investigation tools and techniques.

  We are an equal-opportunity employer and value diversity at our company. We do not discriminate based on race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

  
  

  Want the inside scoop on our culture, the interview process, and the amazing team at Pluang? Click here to find out!

  
  

  Curious about what it's like to work with us? Get a glimpse of life at Pluang through the eyes of our team! Check out our Instagram!